SteamWar/Paper
10
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Also check for the actual character length in ResourceLocation validation

Browse Source
This commit is contained in:
Nassim Jahnke
2024-01-12 23:08:19 +01:00
parent 12960f7064
commit 0fb2a8eea3
2 changed files with 14 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
patches/server/Validate-ResourceLocation-in-NBT-reading.patch
View File

@@ -29,7 +29,13 @@ index 0000000000000000000000000000000000000000..00000000000000000000000000000000
private final String path;
protected ResourceLocation(String namespace, String path, @Nullable ResourceLocation.Dummy extraData) {
+ if (io.netty.buffer.ByteBufUtil.utf8MaxBytes(namespace + ":" + path) > 2 * Short.MAX_VALUE + 1) throw new ResourceLocationException("Resource location too long: " + namespace + ":" + path); // Paper - Validate ResourceLocation
+ // Paper start - Validate ResourceLocation
+ // Check for the max network string length (capped at Short.MAX_VALUE) as well as the max bytes of a StringTag (length written as an unsigned short)
+ final String resourceLocation = namespace + ":" + path;
+ if (resourceLocation.length() > Short.MAX_VALUE || io.netty.buffer.ByteBufUtil.utf8MaxBytes(resourceLocation) > 2 * Short.MAX_VALUE + 1) {
+ throw new ResourceLocationException("Resource location too long: " + resourceLocation);
+ }
+ // Paper end - Validate ResourceLocation
this.namespace = namespace;
this.path = path;
}